add prod infra

.gitlab-ci.yml

@@ -18,9 +18,11 @@ generate-pipeline:
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_COMMIT_BRANCH == "stage"'
+    - if: '$CI_COMMIT_BRANCH == "master"'
     - if: '$CI_COMMIT_BRANCH =~ /^feature\/.*/'
 
-trigger-downstream:
+# Stage environment
+trigger-downstream-stage:
   stage: trigger
   needs:
     - generate-pipeline
@@ -41,7 +43,34 @@ trigger-downstream:
     S3_STATE_BUCKET: ${S3_STATE_BUCKET}
     AWS_ACCESS_KEY_ID: ${S3_ACCESS_KEY}
     AWS_SECRET_ACCESS_KEY: ${S3_SECRET_KEY}
+    TARGET_ENV: "stage"
   rules:
     - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
     - if: '$CI_COMMIT_BRANCH == "stage"'
     - if: '$CI_COMMIT_BRANCH =~ /^feature\/.*/'
+
+# Prod environment
+trigger-downstream-prod:
+  stage: trigger
+  needs:
+    - generate-pipeline
+  trigger:
+    include:
+      - artifact: .gitlab-ci.generated.yml
+        job: generate-pipeline
+    strategy: depend
+  variables:
+    TERRAFORM_IMAGE_NAME: cr.yandex/crp3ccidau046kdj8g9q/terraform/terragrunt:v9.10
+    YC_SERVICE_ACCOUNT_KEY_FILE: ${YC_PROD_SERVICE_ACCOUNT_KEY_FILE}
+    YC_CLOUD_ID: ${YC_CLOUD_ID}
+    YC_STAGE_FOLDER_ID: ${YC_STAGE_FOLDER_ID}
+    YC_PROD_FOLDER_ID: ${YC_PROD_FOLDER_ID}
+    YC_PREPROD_FOLDER_ID: ${YC_PREPROD_FOLDER_ID}
+    S3_ACCESS_KEY: ${S3_PROD_ACCESS_KEY}
+    S3_SECRET_KEY: ${S3_PROD_SECRET_KEY}
+    S3_STATE_BUCKET: ${S3_PROD_STATE_BUCKET}
+    AWS_ACCESS_KEY_ID: ${AWS_PROD_ACCESS_KEY_ID}
+    AWS_SECRET_ACCESS_KEY: ${AWS_PROD_SECRET_ACCESS_KEY}
+    TARGET_ENV: "prod"
+  rules:
+    - if: '$CI_COMMIT_BRANCH == "master"'

infrastructure.yaml

@@ -5,11 +5,7 @@ environments:
         labels:
           environment: stage
           project: pulse
-        annotations:
+          istio-injection: enabled
-          managed-by: terraform
-      - name: block-analyzer
-        labels:
-          project: block-analyzer
         annotations:
           managed-by: terraform
 
@@ -23,7 +19,7 @@ environments:
         namespace: pulse
         type: s3
         dependencies:
-          bucket: pulse-stage
+          bucket: pulse-prod
         lifecycle:
           ignore_changes: false
 
@@ -32,28 +28,12 @@ environments:
         namespace: pulse
         type: database
         dependencies:
-          cluster: "c9qa2coo5ukgcg93fldm"
+          cluster: "c9quu72dj2ibu8dk54q5"
           db: pulse_db
           user: pulse
         lifecycle:
           ignore_changes: true
 
-      - name: analyzer-postgresql-secret
-        namespace: block-analyzer
-        type: database
-        dependencies:
-          cluster: "c9qa2coo5ukgcg93fldm"
-          db: analyzer_db
-          user: analyzer
-        custom_keys:
-          sslmode: "verify-full"
-        random_keys:
-          full-host:
-            length: 32
-            special: false
-        lifecycle:
-          ignore_changes: true
-
       - name: session-secret
         namespace: pulse
         type: opaque
@@ -80,83 +60,25 @@ environments:
       #     ignore_changes: false
 
     buckets:
-      - name: pulse-stage
+      - name: pulse-prod
-        acl: public-read
+        acl: private
         versioning:
           enabled: false
         cors:
-          enabled: true
+          enabled: false
-          allowed_headers: ["*"]
+  
-          allowed_methods: ["GET", "PUT", "POST", "DELETE", "HEAD"]
-          allowed_origins: ["*"]
-          expose_headers: ["ETag"]
-          max_age_seconds: 3600
   
 
     databases:
-      - cluster_id: "c9qa2coo5ukgcg93fldm"
+      - cluster_id: "c9quu72dj2ibu8dk54q5"
         database:
           name: pulse_db
+          extensions:
+            - pg_stat_statements
         user:
           name: pulse
           password_length: 32
           password_special: false
           conn_limit: 10
-      - cluster_id: "c9qa2coo5ukgcg93fldm"
-        database:
-          name: analyzer_db
-          extensions:
-            - pg_stat_statements
-        user:
-          name: analyzer
-          password_length: 32
-          password_special: false
-          conn_limit: 10
-          permissions:
-            - pulse_db
-            - attachments_db
-            - automation_db
-            - bi_db
-            - bim_db
-            - bimv2_db
-            - camera_db
-            - camunda_db
-            - checklists_db
-            - comparator_db
-            - comparisons_db
-            - contracts_db
-            - document-understanding
-            - documentations_db
-            - drawings_db
-            - eav_db
-            - flow
-            - ingrad-notifications
-            - inspections_db
-            - issues_db
-            - keycloak
-            - mailer_db
-            - mcc
-            - metrics
-            - mvp-agents
-            - notes_db
-            - orchestrator
-            - pm-backend
-            - processing_db
-            - remarks_db
-            - resources_db
-            - rfi_db
-            - sarex-management
-            - sarex-compute
-            - sarex_db
-            - srx-data-engine_db
-            - stage-sarex
-            - subscriptions_db
-            - superset_db
-            - system-log_db
-            - test_db
-            - transmittals_db
-            - workspaces_db
-            - zitadel
-            - zitadel-new
           
 

scripts/generate-pipeline.sh

@@ -55,10 +55,25 @@ find live -name "terragrunt.hcl" -not -path "*/.terragrunt-cache/*" | sort | whi
     *) folder_var="YC_FOLDER_ID" ;;
   esac
 
+  # Определяем тег runner'а и правила в зависимости от окружения
+  if [ "$env" = "prod" ]; then
+    runner_tags="  tags:
+    - -prod"
+    branch_rules="    - if: '\$CI_COMMIT_BRANCH == \"master\"'
+    - if: '\$CI_PIPELINE_SOURCE == \"pipeline\" && \$TARGET_ENV == \"prod\"'"
+  else
+    runner_tags=""
+    branch_rules="    - if: '\$CI_PIPELINE_SOURCE == \"merge_request_event\"'
+    - if: '\$CI_COMMIT_BRANCH == \"stage\"'
+    - if: '\$CI_COMMIT_BRANCH =~ /^feature\\\\/.*/'
+    - if: '\$CI_PIPELINE_SOURCE == \"pipeline\" && \$TARGET_ENV == \"stage\"'"
+  fi
+
   cat >> "$OUTPUT_FILE" << VALIDATE_JOB
 validate-${job_prefix}:
   stage: validate
   image: \$TERRAFORM_IMAGE_NAME
+${runner_tags}
   variables:
     TG_ROOT: "${full_component_dir}"
     ENVIRONMENT: "${env}"
@@ -72,10 +87,7 @@ validate-${job_prefix}:
     - terragrunt init -upgrade -reconfigure
     - terragrunt validate
   rules:
-    - if: '\$CI_PIPELINE_SOURCE == "merge_request_event"'
+${branch_rules}
-    - if: '\$CI_COMMIT_BRANCH == "stage"'
-    - if: '\$CI_COMMIT_BRANCH =~ /^feature\\/.*/'
-    - if: '\$CI_PIPELINE_SOURCE == "pipeline"'
   interruptible: true
   artifacts:
     paths:
@@ -102,6 +114,7 @@ VALIDATE_JOB
 plan-${job_prefix}:
   stage: plan
   image: \$TERRAFORM_IMAGE_NAME
+${runner_tags}
   variables:
     TG_ROOT: "${full_component_dir}"
     ENVIRONMENT: "${env}"
@@ -114,10 +127,7 @@ plan-${job_prefix}:
     - terragrunt init -upgrade -reconfigure
     - terragrunt plan -out=tfplan
   rules:
-    - if: '\$CI_PIPELINE_SOURCE == "merge_request_event"'
+${branch_rules}
-    - if: '\$CI_COMMIT_BRANCH == "stage"'
-    - if: '\$CI_COMMIT_BRANCH =~ /^feature\\/.*/'
-    - if: '\$CI_PIPELINE_SOURCE == "pipeline"'
   interruptible: true
   artifacts:
     paths:
@@ -142,10 +152,24 @@ PLAN_JOB
     apply_before_script="cd live/${env}/namespace && terragrunt init -upgrade -reconfigure && cd ../s3 && terragrunt init -upgrade -reconfigure && cd ../database && terragrunt init -upgrade -reconfigure && cd ../secrets && ls -la"
   fi
   
+  # Apply rules в зависимости от окружения
+  if [ "$env" = "prod" ]; then
+    apply_rules="    - if: '\$CI_COMMIT_BRANCH == \"master\"'
+      when: ${when_clause}
+    - if: '\$CI_PIPELINE_SOURCE == \"pipeline\" && \$TARGET_ENV == \"prod\"'
+      when: ${when_clause}"
+  else
+    apply_rules="    - if: '\$CI_COMMIT_BRANCH == \"stage\"'
+      when: ${when_clause}
+    - if: '\$CI_PIPELINE_SOURCE == \"pipeline\" && \$TARGET_ENV == \"stage\"'
+      when: ${when_clause}"
+  fi
+
   cat >> "$OUTPUT_FILE" << APPLY_JOB
 apply-${job_prefix}:
   stage: apply
   image: \$TERRAFORM_IMAGE_NAME
+${runner_tags}
   variables:
     TG_ROOT: "${full_component_dir}"
     ENVIRONMENT: "${env}"
@@ -158,10 +182,7 @@ apply-${job_prefix}:
     - terragrunt init -upgrade -reconfigure 
     - terragrunt apply -auto-approve
   rules:
-    - if: '\$CI_COMMIT_BRANCH == "stage"'
+${apply_rules}
-      when: ${when_clause}
-    - if: '\$CI_PIPELINE_SOURCE == "pipeline" && \$CI_COMMIT_BRANCH == "stage"'
-      when: ${when_clause}
   interruptible: true
 
 APPLY_JOB